Medium severity · published Aug 13, 2024
CVE-2021-26367
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to…
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to a loss of integrity and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Athlon Gold 3150c Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AG
Athlon Gold 3150g Firmware · Amd
before comboam4pi_1.0.0.9 · source: NVD
AG
Athlon Gold 3150u Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AG
Athlon Gold Pro 3150g Firmware · Amd
before comboam4pi_1.0.0.9 · source: NVD
AG
Athlon Gold Pro 3150ge Firmware · Amd
before comboam4pi_1.0.0.9 · source: NVD
AP
Athlon Pro 300ge Firmware · Amd
before comboam4pi_1.0.0.9 · source: NVD
AP
Athlon Pro 3045b Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AP
Athlon Pro 3145b Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AS
Athlon Silver 3050c Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AS
Athlon Silver 3050e Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
AS
Athlon Silver 3050u Firmware · Amd
before picassopi-fp5_1.0.0.e · source: NVD
RS
Radeon Software · Amd
before 23.12.1; through 23.q4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26367
Vendor Advisory
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4004.html
Vendor Advisory
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
More from Athlon Gold 3150c Firmware
7.8
CVE-2023-20555
Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially…
7.8
CVE-2021-26316
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management…
7.8
CVE-2021-26392
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the…
7.8
CVE-2020-12931
Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity
7.8
CVE-2020-12930
Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity